How do you implement automated incident response workflows?

Automated incident response follows a detect-triage-respond-resolve-review pipeline. Detection: monitoring tools (Datadog, PagerDuty, CloudWatch) emit alerts based on thresholds and anomaly detection. Automated triage: classify severity using ML (based on affected service, error rate, customer impact), enrich the alert with context (recent deployments, related alerts, historical incidents), and determine the on-call responder. Response automation: for known issue patterns, execute runbooks automatically (restart service, scale resources, failover to backup, rollback deployment). Implementation: use PagerDuty Event Orchestration or Opsgenie for alert routing, Rundeck or StackStorm for runbook automation, and custom webhooks for tool integration. Workflow: alert received, auto-create incident ticket in Jira/ServiceNow, notify on-call via PagerDuty, create dedicated Slack channel with relevant stakeholders, attach dashboards and logs, run diagnostic scripts, attempt auto-remediation for known patterns, and escalate to humans for novel issues. Post-resolution: auto-generate incident report with timeline, trigger blameless post-mortem workflow, update runbooks with new learnings, and train ML model on new incident data. Metrics: MTTA (mean time to acknowledge), MTTR (mean time to resolve), auto-resolution rate, and escalation frequency.